Remarks 

In response to the Office Action dated June 09, 2008, Applicants respectfully request 
reconsideration based on the above claim amendment and the following remarks. Applicants 
respectfully submit that the claims as presented are in condition for allowance. Claims 1, 14, 25, 
43, 60, 69, 78, 84 and 85 have been amended. 

Interview Summary 

A telephone interview was conducted on August 8 between the undersigned and 
Examiner Doan. During the interview it was discussed that the current combination of 
references fails to describe a traffic log being generated that is specific to a particular packet. No 
agreement was reached. 

Claim Rejections - 35 U.S.C. §112 

Claims 1-5, 7-35 and 60-77 stand rejected under 35 USC §1 12 second paragraph, as 
being indefinite for failing to particularly point and distinctly claim the subject matter which 
applicant regards as the invention. Specifically, independent claims 1, 14, 25, 60 and 69 stand 
rejected for including the recitation "determine the time" which allegedly lacks antecedent basis. 
The recitation has been amended to read "a time". As such, the independent claims have 
antecedent basis. Therefore the rejections may be withdrawn. 

Claim Rejections - 35 U.S.C. §103 

Claims 1-5, 7-39, and 41-52 and 54-87 are rejected under 35 U.S.C. § 103(a) as being 
unpatentable over Diebboll (U.S. Pat. 5,886,643), in view of Galand (U.S. Pat. 6, 529,475) and 
further in view of Messinger et al. (U.S. Pat. 6,687,750). The rejection of these claims is 
respectfully traversed. 

It is respectfully submitted that the combination of Diebboll, Galand, and Messinger fails 
to describe each and every feature specified in amended independent claim 1. In its rejection, the 
Office Action concedes that Diebboll fails to describe a) "that a packet state includes a congested 
state"; b) "the time of creation of the packet log"; and c) that "the histogram file us utilized to 
monitor network conditions in near real time enabling the detection and correction of network 
overloads and congestion before network customers are affected". The Office Action proceeds 
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by asserting that Galand describes determining the congestion of the network from information 
extracted from the network packet and describes "real time traffic". 

The Office Action further concedes that the combination of Diebboll and Galand fails to 
describe the "time of creation of the packet log" and further fails to describe that the "histogram 
file is utilized to monitor network conditions and enabling detection and correction of network 
overloads and congestion before network customers are affected". The Office Action proceeds 
further by asserting that Messinger cures these conceded deficiencies in the combination of 
Diebboll and Galand. 

However, in addition to the conceded discrepancies above, Applicants respectfully assert 
that the current set of references fails to describe other claim elements. For example, Applicants 
respectfully point out that although the Office Action asserts that Diebboll describes ". . .a traffic 
log specific to a particular packet, based upon detection of a content of a packet. . ." the 
combination of Diebboll, Galand and Messinger actually does not describe the creation of a 
traffic log specific to a particular packet. Applicants respectfully traverse the rejections as 
more fully discussed below. 

Claims 1-5, 7-39, 41-52 and 54-87 

Amended independent claim 1 recites, in pertinent part: 

"[a] method of monitoring a packet-switched network using traffic logs, comprising. . .(b) 
at a first location within the packet-switched network, generating a traffic log specific to a 
particular packet based upon detection of a content of the packet. . ." 

Applicants respectfully assert that in addition to the conceded deficiencies in the 
combination of Diebboll and Galand listed above, the combination of Diebboll, Galand and 
Messinger fails to describe "generating a traffic log specific to a particular packet based upon 
detection of a content of the packet. . .". 

In its written rejection, the Office Action asserts that Diebboll describes "a traffic log 
specific to a particular packet based upon detection of a content of a packet" and relies on Col. 2, 
1. 1-10 to support its assertion. Applicants respectfully disagree. 

The cited portion of Diebboll merely describes that a network management system polls 
network probes that monitor traffic flow and stores the polled data in a plurality of records where 
a record identifies a probe, a source node, a destination node and a measure of traffic between 
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the source and destination nodes. (Col. 2, 1. 40-47). Applicants respectfully point out that a 
Diebboll "record" is an aggregated record of traffic passing by the probe and is not a traffic log 
specific to a particular packet based upon detection of a content of the packet. Applicants 
respectfully point to Figure 2 and its associated discussion in Diebboll that explicitly describes a 
record as a record of aggregated traffic. 

Specifically, Diebboll describes that a probe will record the number of packets that it sees 
pass between node A and node B. (Col. 7, 1. 18-40). The conversation between node A and 
node B includes the protocol used, the type of protocol and the application. (Col. 5, 1. 42-51). A 
record includes a variety of aggregate information. (Col. 6, 1. 30-50). Diebboll is absolutely 
devoid of any description of generating a traffic log specific to a particular packet. Creating 
a record of aggregated traffic passing by a probe is a completely different concept than creating a 
traffic log specific to every particular packet. 

Since Diebboll fails to describe generating a traffic log specific to a particular packet 
based upon detection of a content of the packet, Diebboll fails to describe the subject matter 
asserted to Diebboll by the Office Action. 

Applicants respectfully note that Galand fails to cure this additional discrepancy in 
Diebboll. Galand is concerned with a congestion detection and control in a packet switched 
network. Galand describes that when a congestion situation is encountered by a packet at a node 
the node sets a packet header field to "1". When the congestion field is detected at the 
destination end-user, the end-user device sets a congestion field set to "1" in a return packet so 
that when the return packet reaches the sending end-user a counter is incremented or 
decremented. The Galand system thereby provides a feedback mechanism to the sending unit 
prompting it to take congestion control actions. Galand is not describing "generating, . . .a traffic 
log specific to a particular packet based upon detection of a content of the packet ..." There is 
simply no description of a traffic log being created specific to a particular packet described in 
Galand. Setting a packet header field to "1" or incrementing a counter at a sending device is not 
generating a traffic log specific to a particular packet. A packet is also not a packet log. As 
such, Galand fails to cure this discrepancy in Diebboll. 

Messinger fails to cure the above discrepancies in the combination of Diebboll and 
Galand. Messinger is concerned with assembling aggregated network information in a database 
and then querying the database for information about a network node to be rendered as a visual 
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display. Messinger describes that routers collect aggregated information about all of the data 
that passes through them. A reporting application monitors the state of each network 
component as the data transits the network and stores the aggregated information in a network 
information storage file from which it is subsequently retrieved for display. (Col. 1, 1. 64-67). 
The reporting application appends the new results to the storage files 204-208. The user then 
manually queries the storage files 204-208 using filters for later use in the visualization 
application. 

Messinger fails to describe "a traffic log specific to a particular packet ..." To the 

contrary, Messinger only describes collecting aggregated data in a file. (Col. 1, 1. 40-45). Since 
Messinger is silent as to generating a traffic log specific to a particular packet, Messinger fails to 
cure this deficiency in the combination of Diebboll and Galand. 

Therefore because none of Diebboll, Galand or Messinger describes "generating, at a first 
location. . .a traffic log specific to a particular packet. . .", their combination also fails to 
describe "generating. . .a traffic log specific to a particular packet. . .". As such, amended 
independent claim 1 is allowable over the combination of Diebboll, Galand and Messinger for at 
least his reason due to a lack of a prima facie case of obviousness. Independent claims 14, 25, 
36, 43, 60, 69 and 78 recite similar subject matter and are allowable over the combination of 
Diebboll, Galand and Messinger for at least the same reasons. 

Furthermore, Applicants respectfully point out that on page 4 the Office Action concedes 
that the combination of Diebboll and Galand fails to describe that ". . .a histogram file is utilized 
to monitor network conditions. . .". Applicants respectfully agree with the Examiner's 
observation and also assert that Messinger absolutely fails to cure this additional discrepancy in 
the combination of Diebboll and Galand. 

None of Diebboll, Galand or Messinger describes the use of histogram files. Although 
the Office Action cites Column 3, 1. 28-52 to support its position, that citation merely describes 
that at a "reporting application constantly monitors the state of each network component" and 
updates the network information file. (Column 4,1. 14-15). Messinger continues on to describe 
use of "colored arrows, bar charts and graphs" by the reporting application but is completely 
silent as to the use of histograms. 

Applicants respectfully point out that a histogram is NOT a bar chart. A histogram is a 
representation of a frequency distribution by means of rectangles whose widths represent class 
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intervals and whose heights represent corresponding frequencies. Webster's New Collegiate 
Dictionary, G.&C. Merriam Company, Springfield , MA (1973). Contrarily, a bar chart is a 
graphic means of comparing quantities by rectangles with lengths proportional to the size of the 
quantities represented. Id. The bar chart widths are equal or otherwise irrelevant. Although 
Messinger describes a bar chart, Messinger fails to describe the use of any histogram, 
whatsoever. As such, amended independent claim 1 is allowable over the combination of 
Diebboll, Galand and Messinger for a least this additional and independent reason. Independent 
claims 14, 25, 36, 43, 60, 69, 78 and 84 recite similar subject matter and are allowable over the 
combination of Diebboll, Galand and Messinger for at least the same reasons. 

Claims 2-5, 7-13, 15-24, 26-35, 37-39, 41-42, 44-48, 61-68, 70-77, 79-83 and 85-87 
depend from an allowable independent claim 1, 14, 25, 36, 43, 60, 69, 78 or 84 and are allowable 
for at least the same reasons discussed above. 

Further still, Applicants respectfully note that the Office Action failed to address 
Applicants' lack of motivation argument on its merits. As such, Applicants reiterate the 
argument herein. 

Applicants respectfully point out that there is no motivation for one of ordinary skill in 
the art to look to Diebboll as a reference because Diebboll teaches away from the claim 
recitations. Diebboll specifically describes that the Network Management System (NMS) 
implements an algorithm which identifies and tags only a subset of all data retrieved from the 
probes. Diebboll continues on to describe that the subset provides the best picture of the 
monitored conversation between a source and destination node. Any non-tagged data is ignored. 
(Col. 6, 1. 10-20). Therefore, Diebboll teaches away from the claims that recite ". . .generating a 
traffic log specific to a particular packet based upon detection of a content of the packet. . ." 
because Diebboll only describes tagging and using a subset of the information from the probes. 

Because Diebboll teaches away from the claim elements, a prima facie case of 
obviousness cannot be established. Therefore, amended independent claims 1, 14, 25, 36, 43, 60, 
69, 78 and 84 are allowable over the Diebboll in any combination with other references Claims 
2-5, 7-13, 15-24, 26-35, 37-39, 41-42, 44-48, 61-68, 70-77, 79-83 and 85-87 depend from an 
allowable independent claim 1, 14, 25, 36, 43, 60, 69, 78 or 84 and are allowable for at least the 
same reasons. 
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Claims 84-89 



Without conceding the correctness of the rejection, claim 84 has been amended to clarify 
that a computer generates and stores pairs of histograms for each host terminal. Amended 
independent claim 84 recites, in pertinent part: 

"[a] system for analyzing the performance of a packet-switched network where packets 
traverse multiple networks, the network automatically generating a traffic log specific to a 
particular packet based upon detection of a content of the packet each time a packet enters or 
exits the packet-switched network, each traffic log including at least a time the traffic log was 
created, the address of the packet sender and packet recipient, and the entry and exit packet- 
switched network nodes, the system comprising. . . 

(b) a computer operable to download the plurality of traffic logs from the traffic log 
database, to analyze each of the plurality of traffic logs to determine one or more values detected 
from each of the packets, and to generate and store pairs of histograms, each pair of histograms 
being generated from information gleaned from the plurality of traffic logs about each of the 
packets, 

wherein at least one pair of histograms is representative of packet traffic passing to and 
from a host connected to the packet-switched network. . ." 



As discussed above in regards to independent claim 1, the combination of Diebboll, 
Galand and Messinger fails to describe that the each traffic log of the plurality is specific to an 
associated packet based upon detection of a content of the packet and fails to describe the use of 
histograms. As such amended independent claim 84 is allowable for at least these same reasons. 

Further, the combination of Diebboll, Galand and Messinger are simply silent as to ". . .a 
computer. . .to generate and store pairs of histograms, each pair of histograms being generated 
from information gleaned from the plurality of traffic logs about each of the packets, wherein at 
least one pair of histograms is representative of packet traffic passing to and from a host 
connected to the packet-switched network. . ." 

Therefore, because the combination of Diebboll, Galand and Messinger fails to describe 
each and every claim element, a prima facie case of obviousness cannot be established. As such, 
amended independent claim 84 is allowable over the current combination of references for at 
least this additional reason. Claims 85-87 depend from an allowable independent claim 84 and 
are allowable for at least the same reasons. 
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Conclusion 

In view of the foregoing amendments and remarks, this application is now in condition 
for allowance. A notice to this effect is respectfully requested. If the Examiner believes, after 
this amendment, that the application is not in condition for allowance, the Examiner is invited to 
call the Applicants' attorney at the number listed below. 

No additional fees are believed due. However, please charge any additional fees or credit 
any overpayment to Deposit Account No. 50-3025. 



Respectfully submitted, 

Date: September 03, 2008 

/Arno T. Naeckel/ 
Arno T. Naeckel 



Withers & Keys, LLC 
P.O. Box 71355 
Marietta, GA 30007-1355 
(678) 565-4748 
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